Skip to main content
IntelOwl is an open-source threat intelligence platform that security teams use to analyze files and observables across many sources from a single interface. Pulsedive ships as a built-in analyzer, so once you add your API key, Pulsedive becomes one of the sources IntelOwl queries automatically whenever you scan a supported observable, alongside whatever other analyzers and playbooks you’ve configured.

Prerequisites

Before you connect IntelOwl to Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • An IntelOwl instance with permission to configure analyzer secrets.

Connecting IntelOwl to Pulsedive

Follow these steps to add your API key, so the Pulsedive analyzer becomes available in your scans and playbooks:
  1. In IntelOwl, go to the Plugins section and find Pulsedive under Analyzers.
  2. Select Your plugin config in the top-right corner, then go to the Secrets section.
  3. Enter your Pulsedive API key as the PULSEDIVE_API_KEY secret.
  4. Save the configuration.
For the analyzer’s source and any updates, visit the IntelOwl GitHub repository.

Verifying the Connection

Confirm that the analyzer runs successfully before you build it into a playbook.
  1. Scan a known domain, IP, URL, or hash from the Observable page.
  2. Select the Pulsedive analyzer and confirm that the scan results appear in the job’s analyzer report.

Using Pulsedive Data in IntelOwl

Once configured, select Pulsedive as an analyzer for any scan, or add it to a playbook, so it runs automatically alongside your other sources. The analyzer supports domain, IP, URL, and hash observables, so it fits into the same scan or playbook as IntelOwl’s other threat intelligence and malware analysis tools.